Application Security
8 articles · written by Niraj Kumar
Security posts that assume you are shipping, not auditing. Each one starts from a concrete failure — a leaked token, an injected script, a tenant reading another tenant's data — and works back to the control that prevents it.
Coverage includes the OWASP Top 10 mapped onto modern JavaScript stacks, XSS and CSRF in React with safe API integration, JWT refresh-token flows with rate limiting, OAuth 2.1 and OpenID Connect including passwordless, zero-trust architecture on AWS and Azure, DevSecOps gates in CI, securing AI-powered Next.js applications against prompt injection, and PostgreSQL Row-Level Security as a hard multi-tenant boundary.
- RAGPostgreSQLNext.js
How to Build a Secure Multi-Tenant RAG Pipeline using PostgreSQL Row-Level Security, Next.js, and JWT Auth
Stop cross-tenant leaks in B2B AI SaaS — PostgreSQL Row-Level Security for embeddings, tenant IDs from Next.js JWTs, and isolated retrieval.
- Node.jsExpressJWT
Secure API Authentication: Implementing JWT and OAuth2 in Node.js and Express
Build production authentication in Node.js and Express with JWT, Google OAuth2, session handling, and role-based access control that actually holds.
- AuthenticationJWTSecurity
Building a Secure Auth Flow with JWT, Refresh Tokens, and Rate Limiting
Build a production auth system with JWT access tokens, rotating refresh tokens and rate limiting — registration, login, protected routes, refresh.
- ReactSecurityXSS
Securing React Apps: XSS, CSRF, and Secure API Integration
Defend React apps against XSS and CSRF, integrate safely with backend APIs, and handle authentication tokens without leaking them to the page.
- Cloud SecurityZero TrustAWS
Cloud Security Essentials for Developers: Designing Zero-Trust Architectures on AWS/Azure
Design zero-trust security on AWS and Azure — IAM policies, network segmentation, service mesh and secrets management, with real code examples.
- SecurityJavaScriptOWASP
Secure-by-Design Web Apps: Implementing OWASP Top 10 in a Modern JavaScript Stack
Implement OWASP Top 10 controls in React, Next.js and Node.js — building secure web apps from the ground up, with practical code examples.
- OAuth 2.1OpenID ConnectPasswordless
Modern Authentication Demystified: Implementing OAuth 2.1, OpenID Connect, and Passwordless Login
Implement modern authentication with OAuth 2.1, OpenID Connect and passwordless flows — real code, PKCE and WebAuthn, and the pitfalls to avoid.
- DevSecOpsSecuritySAST
DevSecOps in Action: Shifting Security Left with SAST, DAST, and SBOMs in Your Pipeline
Shift security left in your CI/CD pipeline with SAST, DAST and SBOMs — a practical setup for secure software from the first commit onward.
Related topics
- Retrieval-Augmented Generation (RAG)
- LangChain & LangGraph
- Large Language Models
- AI Agents
- Next.js
- React
- TypeScript
- Node.js
- PostgreSQL
- Docker & Containers
- DevOps
- CI/CD
- AWS
- n8n Automation